[PATCH v4 01/22] receive-pack: do not overallocate command structure
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Sep 5, 2014, 20:54 UTC
- Message-ID
- <1409950510-10209-2-git-send-email-gitster@pobox.com>
- In-Reply-To
- <1409950510-10209-1-git-send-email-gitster@pobox.com>
An "update" command in the protocol exchange consists of 40-hex old object name, SP, 40-hex new object name, SP, and a refname, but the first instance is further followed by a NUL with feature requests.
The command structure, which has a flex-array member that stores the refname at the end, was allocated based on the whole length of the update command, without excluding the trailing feature requests.
Signed-off-by: Junio C Hamano <gitster@pobox.com> --- builtin/receive-pack.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c index f93ac45..1663beb 100644 --- a/builtin/receive-pack.c +++ b/builtin/receive-pack.c @@ -872,10 +872,11 @@ static struct command *read_head_info(struct sha1_array *shallow) if (parse_feature_request(feature_list, "quiet")) quiet = 1; } - cmd = xcalloc(1, sizeof(struct command) + len - 80); + cmd = xcalloc(1, sizeof(struct command) + reflen + 1); hashcpy(cmd->old_sha1, old_sha1); hashcpy(cmd->new_sha1, new_sha1); - memcpy(cmd->ref_name, line + 82, len - 81); + memcpy(cmd->ref_name, refname, reflen); + cmd->ref_name[reflen] = '\0'; *p = cmd; p = &cmd->next; }
-- 2.1.0-399-g2df620b